Firewall blocking one user profile

[nickster_uk 1]

I've run into a bit of a weird problem today.  I have set up 2 child accounts on my laptop.  Both are monitored with Family Safety and both have been granted access to the internet.  However, one of the accounts is unable to access the net using IE or Firefox.  The only thing that fixes it is disabling the firewall through an elevated uac prompt.

 

There's no rules set to block those apps and prompts appear and access if granted for the other users.  Neither parental controls or profiles are enabled in ESET.

 

The 'Fix connection problems' option in IE state that the connection has been blocked by ESET Security firewall rules but as previously mentioned, there are no such rules blocking IE or FF.

 

Can anyone suggest anything to try please?

[Arakasi 549]

Hi nickster.

 

I would say try switching the firewall to learning mode under the child account, and then launch the browsers. If it works without disabling, switch the firewall mode back to its original, and try again.

 

If it still fails to work correctly, you will need to delete the rules for IE and firefox, and create them again, using learning or interactive mode.

[nickster_uk 1]

Thanks for the reply Arakasi.

 

Learning mode made no difference for the user.  There are absolutely no rules for IE and FF set in ESET which is making this very frustrating to resolve.  The browsers work fine for the user when the firewall is disabled or in automatic mode.

 

I'm going to try a repair install or ESS to see if that helps.

[nickster_uk 1]

Repair didn't work.  Will try a clean reinstall.

[nickster_uk 1]

Some progress....

 

Firefox now works, but still no joy from IE in interactive mode.

 

I exported my rules before uninstalling.  Rebooted, reinstalled with internet disconnected.  Set up ESS for interactive mode without any rules imported or created.  Switched user profile to child account then enabled internet but still nothing.

 

Absolutely bizarre as there are no rules including IE on my system but ESS is still blocking it for one user.

 

Running out of ideas now.

[nickster_uk 1]

IE on the other child account started getting blocked so as a test I decided to change the child accounts to standard accounts which also removes them from Family Safety filtering and things start to work straight away!

 

It's just incredibly strange that ESET is involved in the blocking process for Family Safety/child accounts.

 

Any ideas please?

[Arakasi 549]

I don't think the rules arent getting created properly and there are more that could be popping up in interactive mode.

Child accounts cannot approve the creation of rules so they will automatically get blocked.

 

Reinstall ESET, switch to learning mode, turn on your parental accounts.

Use it that way for at least a full 24 hours including using the child account to browser.

Then switch to interactive mode the following day.

[Marcos 5,468]

1. clear your firewall log

in the IDS setup, enable logging of blocked connections

reproduce the problem

post your firewall log records here

[nickster_uk 1]

Thanks.

 

Was just about to give v7.0.302.26 a try.  I have been using v6.0.316.0 until now so perhaps v7 will help.

Edited April 12, 2014 by nickster_uk

[nickster_uk 1]

 

1. clear your firewall log
2. in the IDS setup, enable logging of blocked connections
3. reproduce the problem
4. post your firewall log records here

 

Thanks Marcos...that brings me to another point.  Most ESET logs are empty.  Only the Events log has any entries.

Edited April 12, 2014 by nickster_uk

[nickster_uk 1]

Same problem on v7.

 

As soon as monitoring is disabled, IE access is returned as normal.

 

I'm sure this would be very easy to reproduce.  Is anyone else able to confirm whether they have been able to get the same results please?

 

Attached firewall log.

FirewallLog.zip

[Arakasi 549]

What OS, i will try.

 

Also, please follow Marcos suggestions because he will be able to ascertain the problem by viewing your logs.

This will get you a fix from ESET if needed.

Edited April 12, 2014 by Arakasi

[nickster_uk 1]

I'm using Windows 8.1 Professional.

 

Have attached the logs required by Marcos in previous post.

[Arakasi 549]

Here is what i suspect is happening.

Parental controls uses a different DNS then the one provided by your ISP in your router/modem.

When the child profile in question attempts to launch Internet explorer and visit a site. It requests the IP from ESET's DNS and checks against your rules or theirs.

Your computer must contact 224.0.0.252 which will convert website to IP and allow you to visit.

 

If the learning mode does not allow the creation of these allowed rules, and since the child account cannot respond to rule changing due to requiring admin access or Parent control access, i would say this could be a flaw.

 

I would have thought that ESET had the dns already allowed in the program but, Interactive mode is a different and very strong way of using a firewall.

How does it act in automatic mode with rules ?

 

 

One thing to keep in mind. The DNS request is being blocked by the firewall, and if you were to allow an exception for that DNS, parental controls might begin to work as intended.

 

224.0.0.252 IP to add to exception.

 

Its buried deep in the program, but its something like this :

 

Advanced settings > Network > Personal firewall > Rules and zones > Setup under editor > Rules tab > New > Remote tab and add IPv4 address allow for udp.

 

Maybe this will resolve the issue ?

Let us know if you get stuck or if it helps !

 

Edited April 13, 2014 by Arakasi

[nickster_uk 1]

I got excited for a second.  I added the rule and Google popped up on the child account.....

 

Then I remembered that I left the firewall in automatic mode with rules!  I switched it back to interactive and it's still the same as before

 

So to confirm, IE works on the child accounts when ESS is set to automatic mode with exceptions, automatic or disabled but fails to work in other modes when Family Safety is enabled on the account...with or without the rule you suggested.

 

Gonna call it a night now but I really appreciate the help so far.

[Arakasi 549]

No problem, maybe Marcos will have a good suggestion as well from ESET.

Now that we know what is going on.